[justinclift]

Hmmm. Lets say you have a plumber install a sink at your house, and you're happy with it.

If you later on decide you want something extra done to the sink, and the plumber says "oh, that's easy I can do that for you for free in a few weeks..." that would generally be a positive right?

But lets say you wanted it done Real Soon Now instead. Like tomorrow or the next day.

If the plumber's response was "Well, that can be done but I'll have to charge you our normal rates", that doesn't sound unreasonable does it?

That's what this situation seems like to me. I'm not sure why you're thinking there's attempted extortion involved?

[harrid]

Bad analogy. There is reasonable expectation that security related bugs will be fixed in a reasonable time. And that it won't be a premium feature. Not legally of course as it's free etc. But that's commonly how the world works.

A better analogy would be Microsoft asking for money to fix a security bug in Windows.

[smarnach]

This, I think, is the core issue of this thread. It's totally not reasonable to expect anything from people who were kind enough to put their code on the internet for free for others to use. The requester is using the code someone gifted them to make money, and expects the other person continue volunteering their time for free so they can make more money. Moreover, there is no actual security vulnerability here.

[Skunkleton]

Most Free Software projects are not professional. Time is spent on them for personal reasons. Those reasons may not align with users of that project, but that is just too bad. If you don't like it, all you are entitled to is the source code.

> A better analogy would be Microsoft asking for money to fix a security bug in Windows.

Microsoft has the exact same practice. If you want to tell Microsoft how to spend their time, you better be prepared to fork over lots of money.

[harrid]

Ok then how if Firefox would only release a critical Bugfix to paying users. Same thing - they would rightfully be called out on that.

[Skunkleton]

Firefox is maintained by paid employees. This is not the same thing. There is no talk of making this a paid only release anywhere. Please avoid strawmen.

[harrid]

That's irrelevant as they're not paid by the user.

[allarm]

That’s absolutely relevant because Mozilla engineers are getting paid in the end. It’s reasonable to expect to get job done for the money. The volunteer devs are not getting paid and do their FOSS job after hours. There’s no obligations whatsoever.

[wickedsickeune]

Windows is a paid product, FOSS is not. Plus you not only cannot, it's also illegal to fix the security bug yourself in Windows. Meanwhile, if someone needs something changed in FOSS they are free to do it themselves (it wasn't even a change, just a stupid rubber stamp)

[pests]

> reasonable expectation that security related bugs will be fixed in a reasonable time

Who gave you this expectation?

[justinclift]

Heh Heh Heh. On a tangent, that seems to be what Canonical is doing with Ubuntu subscriptions these days. :/